egressFilter blocks ALL node egress traffic on 2.8.0

[k3v1ch]

Node version: 2.8.0 (Docker, remnawave/node:latest), panel 2.8.0

Symptom: with any plugin config where egressFilter.enabled: true, all outbound traffic from the node host is dropped: clients complete the handshake (VLESS Reality / Hysteria2), xray access.log shows connections "accepted", but no data flows — browsers show ERR_CONNECTION_CLOSED. Disabling only the egressFilter (all other plugins still enabled) fully restores traffic.

Bisection (single node, vanilla config: one vless-reality inbound + freedom outbound, tested one change at a time):

egressFilter	blockedIps	blockedPorts	result
on	RFC1918 + bogons (17 entries)	25,465,587,2525	broken
on	same minus 240.0.0.0/4	same	broken
on	same minus 0.0.0.0/8, ::/128, ::1/128	same	broken
on	full (17)	[] (empty)	broken
off	—	—	works

The breakage is independent of the set contents — it looks like the egress chain itself drops/rejects everything once it is created.

Other plugins verified fine in isolation on 2.8.0: connectionDrop (with node IPs whitelisted), ingressFilter, torrentBlocker.

Why this wasn't visible before 2.8.0: node 2.7.0 was built on node:24.14-alpine (musl), while nftables-napi ≤ 0.4.4 and sockdestroy ≤ 1.3.0 shipped no musl prebuilds — the native binding failed to load, so plugin enforcement was silently a no-op (sync logs looked normal). 2.8.0 moved to Debian trixie (glibc), so the nft rules actually get installed for the first time — and the egress chain issue surfaces immediately.

Filed a companion issue in nftables-napi as the chain/rule creation lives there.

Happy to provide more details (plugin JSON, nft ruleset dump from an affected host).

[kastov]

while nftables-napi ≤ 0.4.4 and sockdestroy ≤ 1.3.0 shipped no musl prebuilds

This information is incorrect. All plugins worked correctly on version 2.7.0. The specified versions of these modules had default musl prebuilds.

[kastov]

  "egressFilter": {
    "enabled": true,
    "blockedIps": [
      "0.0.0.0/8",
      "10.0.0.0/8",
      "100.64.0.0/10",
      "127.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.0.0.0/24",
      "192.0.2.0/24",
      "192.88.99.0/24",
      "192.168.0.0/16",
      "192.175.48.0/24",
      "198.18.0.0/15",
      "198.51.100.0/24",
      "203.0.113.0/24",
      "224.0.0.0/4",
      "240.0.0.0/4"
    ],
    "blockedPorts": [
      25,
      465,
      587,
      2525
    ]
  },

I just tested everything with this configuration and found no issues. Xray and connections through it work correctly, and all tables are created completely correctly.

table ip remnanode {
        counter processed {
                packets 3993 bytes 3657743
        }

        counter ingress-filter-ip {
                packets 0 bytes 0
        }

        counter torrent-blocker {
                packets 0 bytes 0
        }

        counter egress-filter-ip {
                packets 0 bytes 0
        }

        counter egress-filter-port {
                packets 0 bytes 0
        }

        set ingress-filter-ip {
                type ipv4_addr
                flags interval,timeout
                counter
        }

        set torrent-blocker {
                type ipv4_addr
                flags interval,timeout
                counter
        }

        set egress-filter-ip {
                type ipv4_addr
                flags interval,timeout
                counter
                elements = { 0.0.0.0/8 counter packets 0 bytes 0, 10.0.0.0/8 counter packets 0 bytes 0,
                             100.64.0.0/10 counter packets 0 bytes 0, 127.0.0.0/8 counter packets 0 bytes 0,
                             169.254.0.0/16 counter packets 0 bytes 0, 172.16.0.0/12 counter packets 0 bytes 0,
                             192.0.0.0/24 counter packets 0 bytes 0, 192.0.2.0/24 counter packets 0 bytes 0,
                             192.88.99.0/24 counter packets 0 bytes 0, 192.168.0.0/16 counter packets 0 bytes 0,
                             192.175.48.0/24 counter packets 0 bytes 0, 198.18.0.0/15 counter packets 0 bytes 0,
                             198.51.100.0/24 counter packets 0 bytes 0, 203.0.113.0/24 counter packets 0 bytes 0,
                             224.0.0.0/4 counter packets 0 bytes 0, 240.0.0.0/4 counter packets 0 bytes 0 }
        }

        set egress-filter-port {
                type inet_proto . inet_service
                flags timeout
                counter
                elements = { tcp . 25 counter packets 0 bytes 0,
                             udp . 25 counter packets 0 bytes 0,
                             tcp . 587 counter packets 0 bytes 0,
                             udp . 587 counter packets 0 bytes 0,
                             tcp . 465 counter packets 0 bytes 0,
                             udp . 465 counter packets 0 bytes 0,
                             tcp . 2525 counter packets 0 bytes 0,
                             udp . 2525 counter packets 0 bytes 0 }
        }

        chain input {
                type filter hook input priority filter - 10; policy accept;
                counter name "processed"
                ip saddr @ingress-filter-ip log prefix "ingress-filter-ip: " counter name "ingress-filter-ip" drop
                ip saddr @torrent-blocker log prefix "torrent-blocker: " counter name "torrent-blocker" drop
        }

        chain forward {
                type filter hook forward priority filter - 10; policy accept;
                counter name "processed"
                ip saddr @ingress-filter-ip log prefix "ingress-filter-ip: " counter name "ingress-filter-ip" drop
                ip saddr @torrent-blocker log prefix "torrent-blocker: " counter name "torrent-blocker" drop
        }

        chain output {
                type filter hook output priority filter - 10; policy accept;
                ip daddr @egress-filter-ip counter name "egress-filter-ip" drop
                meta l4proto . th dport @egress-filter-port counter name "egress-filter-port" drop
        }
}
table ip6 remnanode6 {
        counter processed {
                packets 0 bytes 0
        }

        counter ingress-filter-ip6 {
                packets 0 bytes 0
        }

        counter torrent-blocker6 {
                packets 0 bytes 0
        }

        counter egress-filter-ip6 {
                packets 0 bytes 0
        }

        counter egress-filter-port6 {
                packets 0 bytes 0
        }

        set ingress-filter-ip6 {
                type ipv6_addr
                flags interval,timeout
                counter
        }

        set torrent-blocker6 {
                type ipv6_addr
                flags interval,timeout
                counter
        }

        set egress-filter-ip6 {
                type ipv6_addr
                flags interval,timeout
                counter
        }

        set egress-filter-port6 {
                type inet_proto . inet_service
                flags timeout
                counter
                elements = { tcp . 25 counter packets 0 bytes 0,
                             udp . 25 counter packets 0 bytes 0,
                             tcp . 587 counter packets 0 bytes 0,
                             udp . 587 counter packets 0 bytes 0,
                             tcp . 465 counter packets 0 bytes 0,
                             udp . 465 counter packets 0 bytes 0,
                             tcp . 2525 counter packets 0 bytes 0,
                             udp . 2525 counter packets 0 bytes 0 }
        }

        chain input {
                type filter hook input priority filter - 10; policy accept;
                counter name "processed"
                ip6 saddr @ingress-filter-ip6 log prefix "ingress-filter-ip: " counter name "ingress-filter-ip6" drop
                ip6 saddr @torrent-blocker6 log prefix "torrent-blocker: " counter name "torrent-blocker6" drop
        }

        chain forward {
                type filter hook forward priority filter - 10; policy accept;
                counter name "processed"
                ip6 saddr @ingress-filter-ip6 log prefix "ingress-filter-ip: " counter name "ingress-filter-ip6" drop
                ip6 saddr @torrent-blocker6 log prefix "torrent-blocker: " counter name "torrent-blocker6" drop
        }

        chain output {
                type filter hook output priority filter - 10; policy accept;
                ip6 daddr @egress-filter-ip6 counter name "egress-filter-ip6" drop
                meta l4proto . th dport @egress-filter-port6 counter name "egress-filter-port6" drop
        }
}